fa6ce8cc00
fix(server): collapse OAuth callback messages to prevent email-existence oracle
...
Two distinct error messages in the OAuth callback endpoint revealed
whether an email address was already registered in the database.
An attacker controlling the OAuth provider's email claim could probe
the user table without authentication. Both cases now return the same
generic message.
2026-04-30 11:54:00 +02:00
8011adadb6
fix(server): prevent login timing oracle by always running bcrypt
...
Always call compareBcrypt in the login path regardless of whether the
email is registered. When no user is found, a dummy hash is used so the
bcrypt KDF still runs and response latency is constant, making it
impossible to enumerate valid email addresses by measuring response time.
2026-04-30 11:54:00 +02:00
c1bd7a116b
fix e2e tests
2026-04-30 11:54:00 +02:00
b96421a083
refactor(server)!: sanitize error messages to avoid leaking resource and permission details
2026-04-30 11:53:44 +02:00
65bd0a9320
fix(web): timeline scroll when pressing back from stacked asset ( #28163 )
2026-04-30 11:39:34 +02:00
bf32864644
feat(server): video streaming table definitions ( #28147 )
...
* video streaming table definitions
Co-authored-by: Copilot <copilot@github.com >
* update sql
* tetris
* use enum
Co-authored-by: Copilot <copilot@github.com >
* fix column name
---------
Co-authored-by: Copilot <copilot@github.com >
2026-04-29 15:48:15 +00:00
7ef7ecec5b
chore(deps): update dependency flutter to v3.41.7 ( #28124 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-04-29 10:15:40 -05:00
bc4abd18e4
feat: update iOS CI/CD with FUTO build credential ( #28146 )
...
* update email
* Update fastfile
* use different apple id
* debug build
* build only
2026-04-29 09:06:35 -05:00
b74cfd4424
fix(mobile): suppress asset stack UI in trash timeline ( #26536 )
...
* fix(mobile): suppress asset stack UI in trash timeline
* refactor(mobile): apply review suggestions
* fix(mobile): hide unstack action in the trash timeline
* fix(mobile): move stack indicator out of asset type icons
---------
Co-authored-by: Peter Ombodi <peter.ombodi@gmail.com >
2026-04-29 17:49:47 +07:00
7dc84f56c0
fix(web): double video playback on map timeline ( #28090 )
2026-04-29 12:11:33 +02:00
92634f923b
refactor(server)!: remove redundant error and statusCode fields from error responses ( #28140 )
...
* refactor(server)!: remove redundant error and statusCode fields from error responses
* use enum
* enhance response management
* chore: clean up header
* fix: chaining
* refactor: handle error
* fix e2e tests
---------
Co-authored-by: Jason Rasmussen <jason@rasm.me >
2026-04-28 17:54:54 -04:00
96b6165bd3
refactor(server)!: move correlationId to X-Correlation-ID response header ( #28139 )
2026-04-28 13:07:39 -04:00
2624f3884f
fix(web): large files: better handling of asset deletions ( #28117 )
2026-04-28 18:18:39 +02:00
f9b7ce9407
fix(web): convert shared link expiry to UTC before serialising ( #28135 )
2026-04-28 16:10:08 +00:00
013ea37a0d
refactor!: change number to integer types ( #27912 )
...
* refactor!: change number to integer types
* fix oversight
2026-04-28 11:25:03 -04:00
b2b4385271
chore(web): refactor people panel ( #28136 )
2026-04-28 11:22:22 -04:00
081c75bb21
fix(web): refresh memories hourly ( #28114 )
2026-04-28 11:18:51 -04:00
da337578fb
fix(deps): update typescript-projects ( #28132 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Daniel Dietzler <mail@ddietzler.dev >
2026-04-28 13:18:29 +02:00
acf4109171
chore(deps): update dependency exiftool-vendored to v35.18.0 ( #28133 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-04-28 12:46:54 +02:00
66601a1fdc
chore(deps): update dependency terragrunt to v1.0.2 ( #28125 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-04-28 12:00:44 +02:00
02ff077367
chore(deps): update prom/prometheus docker digest to e425440 ( #28120 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-04-28 12:00:11 +02:00
94bb6c1a5e
chore(deps): update dependency @immich/ui to v0.76.2 ( #28121 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-04-27 21:54:12 -05:00
fe9e5afcf4
fix: do not emit AlbumInvite event for owner ( #28110 )
2026-04-27 17:59:46 +00:00
5e89efba64
fix(ml): handle empty/corrupt images in face detection ( #27391 )
...
* fix(ml): handle empty/corrupt images in face detection
When a corrupt or degenerate image with zero-dimension (0 width or 0 height)
reaches the face detection pipeline, insightface's RetinaFace.detect() calls
cv2.resize() with a target size of 0, triggering an OpenCV assertion failure:
error: (-215:Assertion failed) inv_scale_x > 0 in function 'resize'
This crashes the ML worker and returns a 500 error to the server.
Add an early return in FaceDetector._predict() that checks for zero-dimension
images after decoding and returns empty detection results instead of passing
them to the insightface model.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
* fix(ml): move empty image validation to request level
Per review feedback, validate image dimensions in the predict endpoint
(returning 400) rather than in each model's _predict method. This
catches all zero-dimension images before they reach any model task.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
* fix(ml): resolve mypy strict type error in predict endpoint
Use intermediate `decoded` variable so mypy knows `.width` and `.height`
are accessed on `Image`, not on `Image | str`.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
2026-04-27 11:14:34 -04:00
5a457d72c9
fix(mobile): delete assets on trash empty, Android ( #26070 )
...
* fix(mobile): improve trash sync flow
- trash local assets on remote delete events
- unify remote trash handling and support assetDelete cleanup by remote asset id
- update sync stream tests
* fix(mobile): revert pubspec.lock
* refactor(mobile): remove helper
remove unused columns from results
* refactor(mobile): use remoteIds in getAssetsFromBackupAlbums and remove getAssetsFromBackupAlbumsByRemoteIds
refactor tests
---------
Co-authored-by: Peter Ombodi <peter.ombodi@gmail.com >
2026-04-27 18:46:49 +05:30
45ccdb37fb
refactor(web): replace asset-viewer listener based face hover with overlay elements ( #27400 )
2026-04-27 12:08:34 +02:00
9263e2f2e1
feat(ml): update Intel graphics compiler and compute runtime ( #28076 )
...
feat(ml): update Intel graphics compiler and compute runtime to latest versions
2026-04-25 08:49:57 -04:00
a3ee615c5b
chore(ml): update huggingfacehub and pillow ( #27552 )
2026-04-24 19:44:01 -04:00
39cfad7136
feat(mobile): action bottom sheet on map timeline ( #27515 )
2026-04-24 09:30:10 -05:00
350056dd1a
fix(deps): update dependency uuid to v14 [security] ( #28046 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-04-23 11:24:33 +02:00
f0835d06f8
chore: migrate to FUTO Apple's account ( #28020 )
...
* chore: migrate to FUTO Apple's account
* chore: migrate to FUTO Apple's account
* chore: match widget and share extension
* chore: update app share group
* reuse group.app.immich.share
2026-04-22 11:53:20 -05:00
03b70cf029
fix: jump to timeline on new auto_router update ( #28022 )
2026-04-22 10:21:48 -05:00
4bfb8b36c2
chore!: migrate album owner to album_user ( #27467 )
...
Co-authored-by: mertalev <101130780+mertalev@users.noreply.github.com >
Co-authored-by: shenlong-tanwen <139912620+shalong-tanwen@users.noreply.github.com >
2026-04-22 16:52:23 +02:00
dfacde5af8
fix(deps): update typescript-projects ( #28025 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Daniel Dietzler <mail@ddietzler.dev >
2026-04-22 16:49:28 +02:00
317afe9e3b
fix(web): normalize underscore locale codes in dynamic language selection ( #27900 )
...
Co-authored-by: Daniel Dietzler <mail@ddietzler.dev >
2026-04-22 13:28:33 +00:00
1fb5f13237
fix: oauth prompt ( #28021 )
2026-04-22 09:19:28 -04:00
793a7054fb
fix(mobile): thumbnail transition to asset viewer ( #27850 )
2026-04-21 15:54:40 -05:00
3a874dd441
fix(mobile): enable autoplay for motion photos in video viewer ( #27961 )
2026-04-21 15:53:21 -05:00
3dc7dc93d8
fix(mobile): clear local data on forced logout ( #27957 )
2026-04-21 15:52:00 -05:00
70397dc5a6
fix(mobile): zero exposure ( #28017 )
2026-04-21 15:47:27 -05:00
a16d233a0c
chore(web): sort imports ( #27922 )
...
* feat: sort imports
* fix: something?
2026-04-21 14:51:38 -04:00
bb0872afef
chore: upgrade sql-tools ( #27885 )
2026-04-21 17:42:27 +00:00
b9ca68f6e4
chore(web): rename components to PascalCase ( #28013 )
...
chore: rename components to PascalCase
2026-04-21 12:29:42 -04:00
837305da7e
chore: un-skip tests ( #28012 )
2026-04-21 12:08:23 -04:00
e20fb44142
fix: web navigation/animation regression ( #28011 )
2026-04-21 14:51:37 +00:00
c2786978cd
fix(deps): update typescript-projects ( #28008 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Daniel Dietzler <mail@ddietzler.dev >
2026-04-21 15:29:34 +02:00
312bb91a4f
chore(deps): update github-actions ( #28005 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-04-21 13:35:55 +02:00
c1934b904c
chore(deps): update dependency opentofu to v1.11.6 ( #27999 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-04-21 13:31:16 +02:00
47752d158a
fix(deps): update dependency @mapbox/mapbox-gl-rtl-text to v0.4.0 ( #28007 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-04-21 13:25:30 +02:00
6267322b9c
chore(deps): update dependency exiftool-vendored to v35.17.0 ( #28004 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-04-21 13:08:12 +02:00
timonrieger